CIS 192 – Lesson 9 Lesson Module Status Slides – draft Properties - done Flashcards - 1 st minute quiz – done Web Calendar summary – Web book pages – Commands

CIS 192 – Lesson 9

Lesson Module Status•Slides – draft•Properties - done•Flashcards - •1st minute quiz – done•Web Calendar summary – •Web book pages – •Commands – done•Howtos – •Skills pacing -•Lab – done•Depot (VMs) – na

1

CIS 192 - Lesson 9

Quiz

No Quiz today since we are having a test


Objectives Agenda

• Install DNS

• Configure a primary and secondary nameserver

• Enable periodic zone transfers

• No quiz today!

• Questions on previous material

• Housekeeping

• DNS Overview

• dig command

• host command

• Forward zone database

• Reverse zone database

• named.conf

• Zone transfer

• Troubleshooting

• Lab 7

• Wrap

• Test 2

3

The Domain Name System

Questionson previous

material

4

CIS 192 - Lesson 9

Questions?

• Previous lesson material• Lab assignment

5

Housekeeping

6

CIS 192 - Lesson 9

• No labs due today!

• No class next week - Spring break!

• There are two extra credits labs available:• X1 (permanent NIC configuration) • X2 (PPP).

7

DNS

8

CIS 192 - Lesson 9

9

Who has this IP address?Solution: Use ARP to get MAC address

What is the IP address for this hostname?Solution: Use DNS to resolve hostname

CIS 192 - Lesson 9

10

To resolve "friendly" host names into "hard to remember" IP addresses to reach remote hosts on the Internet

What is DNS used for?

Either www.cabrillo.edu or 207.62.187.7 will work to reach Cabrillo's web server

CIS 192 - Lesson 9

11

First, Frodo needs the MAC address of the router. This is necessary information for any packets to be sent outside the local subnet. ARP is used for this.

CIS 192 - Lesson 9

12

Next, Frodo sends a DNS request to the server specified in /etc/resolv.conf to resolve the name www.cabrillo.edu. The answer comes back as 207.62.187.7.

CIS 192 - Lesson 9

13

Finally , Frodo does a three-way handshake to start a connection with the web server

CIS 192 - Lesson 9

14

Note that request uses UDP and port 53 on the DNS server

And away we go getting the web page …..

CIS 192 - Lesson 9

15

http://www.tldp.org/HOWTO/DNS-HOWTO.html

Very good DNS reference by Nicolai Langfeldt

DNSOverview

16

An Overview of Domain Name SystemCreated in 1984 from the work led by Paul Mockapetris Improves the deficiencies of the /etc/hosts file DNS manages two databases (zones)

Forward lookup zones: for mapping Domain names to IP addresses Reverse lookup zones: for mapping IP addresses to Domain names

Three components to DNS:Resolver The Server

Primary Secondary Caching

Database files (db.domain-name)Supports two type of queries:

Recursive Iterative

Most popular implementation of DNS is Berkely Internet Name Daemon (BIND)Maintained by the Internet Software Consortium: www.ics.org

CIS 192 - Lesson 9

17

Paul worked at the Information Sciences Institute of the University of Southern California






Recursive Iterative


CIS 192 - Lesson 9

18

Can you imagine trying to keep these files updated on every single host in the world?

CIS 192 - Lesson 9

19






Recursive Iterative


In reality, the DNS is a huge, global distributed database spread across all the DNS servers in the world.

Each DNS server is authoritative for its own domain and maintains these forward and reverse lookup zones.

CIS 192 - Lesson 9

20






Recursive Iterative


The client side of DNS. It initiates and sequences the queries that lead to the resolution of a name into an IP address






Recursive Iterative


CIS 192 - Lesson 9

21

Also known as the master server. This server maintains a database of hostname/IP pairs for the systems it serves. This server also provides authoritative answers for these same systems.






Recursive Iterative


CIS 192 - Lesson 9

22

Also known as a slave server. This server is identical to the primary server except it does not maintain its own database. It's data is obtained instead from the primary server. Used as backup when the primary server is down and for load balancing.






Recursive Iterative


CIS 192 - Lesson 9

23

Has no database of its own and does not obtain one from another server. Caching servers make queries on behalf of clients and cache the answers. Caching servers are used for performance reasons.






Recursive Iterative


CIS 192 - Lesson 9

24

Contain the database resource records such as A records that map a hostname to a IP address, PTR records that map IP addresses to hostnames, NS records for name servers, and CNAME records for aliases.

CIS 192 - Lesson 9

25






Recursive Iterative


Provide either an answer or an error message

CIS 192 - Lesson 9

26






Recursive Iterative


Provide either an answer or a referral to another DNS server






Recursive Iterative


CIS 192 - Lesson 9

27

This is what we will install and configure in Lab 7

CIS 192 - Lesson 9

28

The DNS Namespace •Top most domain in the namespace hierarchy is "." •Top-level domains: .com, .net, .gov, .edu, .org .us, ... •Special domain for reverse lookups: in-addr.arpa •Fully Qualified Domain Names read from right to left •Name registration was handled by InterNIC; now belongs to companies for profit.

InterNIC - Internet Network Information Center. Handled domain names and IP addresses prior to 1988 before getting turned over to ICANN

ICANN - Internet Corporation for Assigned Names and Numbers. ICANN accredits the domain name registrars (the companies that compete with other and register domain names)

CIS 192 - Lesson 9

29source: http://en.wikipedia.org/wiki/File:Domain_name_space.svg

Nameless root domain referred to via "."

Generic TLD's - Top Level Domains (com, edu, net, org, mil, etc.)

Next level domains (e.g. hp.com, cabrillo.edu, yahoo.com, webhalks.org, etc.

CIS 192 - Lesson 9

30

source: http://en.wikipedia.org/wiki/File:An_example_of_theoretical_DNS_recursion.svg

CIS 192 - Lesson 9

31

DNS Database Resource Record types:

SOA - Start of Authority NS - Nameserver A - Address PTR - Pointer (for reverse lookups)CNAME - Aliases

CIS 192 - Lesson 9

32

DNS Installation and Configuration

Package names: bind, caching-nameserver

Daemon name: /usr/sbin/named

Startup script: /etc/rc.d/init.d/named startor service named start

Database files: /var/named/named.ca /var/named/db.in-addr.arpa /var/named/db.domain name

Configuration files: /etc/named.conf /etc/resolv.conf /etc/nsswitch.conf

To reload configuration files: rndc reload

IP address of root servers

reverse lookups

forward lookups

Overall configuration file

DNS server to use

Lookup order definition

CIS 192 - Lesson 9

33

Troubleshooting Tools for DNS nslookup - being phased out host dig

dig

34

CIS 192 - Lesson 9

dig +norec +noques +nostats +nocmd simms-teach.com @ns1.dreamhost.com

35

dig (domain information groper) command•Tool to interrogate DNS servers•Performs DNS lookups and displays the answers from the DNS server queried.•Will use name server specified in /etc/resolv.conf unless another is specified

query options name server to query

name to lookup

Some query options+[no]recurse - [do not] use recursive queries+[no]question - [do not] print question section when an answer is returned+[no]stats - [do not] print query statistics+[no]cmd - [do not] print dig version information… for more, use man dig

CIS 192 - Lesson 9

36

An example of what life is like as a resolver doing a forward lookup using the dig command

CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd opus.cabrillo.edu;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19571;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 13

;; AUTHORITY SECTION:. 3600000 IN NS A.ROOT-SERVERS.NET.. 3600000 IN NS L.ROOT-SERVERS.NET.. 3600000 IN NS I.ROOT-SERVERS.NET.. 3600000 IN NS E.ROOT-SERVERS.NET.. 3600000 IN NS D.ROOT-SERVERS.NET.. 3600000 IN NS F.ROOT-SERVERS.NET.. 3600000 IN NS B.ROOT-SERVERS.NET.. 3600000 IN NS M.ROOT-SERVERS.NET.. 3600000 IN NS J.ROOT-SERVERS.NET.. 3600000 IN NS G.ROOT-SERVERS.NET.. 3600000 IN NS K.ROOT-SERVERS.NET.. 3600000 IN NS H.ROOT-SERVERS.NET.. 3600000 IN NS C.ROOT-SERVERS.NET.

;; ADDITIONAL SECTION:B.ROOT-SERVERS.NET. 604794 IN A 192.228.79.201C.ROOT-SERVERS.NET. 604761 IN A 192.33.4.12E.ROOT-SERVERS.NET. 604794 IN A 192.203.230.10F.ROOT-SERVERS.NET. 604791 IN A 192.5.5.241F.ROOT-SERVERS.NET. 604794 IN AAAA 2001:500:2f::fG.ROOT-SERVERS.NET. 604794 IN A 192.112.36.4I.ROOT-SERVERS.NET. 604794 IN A 192.36.148.17J.ROOT-SERVERS.NET. 604794 IN A 192.58.128.30K.ROOT-SERVERS.NET. 604794 IN A 193.0.14.129K.ROOT-SERVERS.NET. 604791 IN AAAA 2001:7fd::1L.ROOT-SERVERS.NET. 604794 IN AAAA 2001:500:3::42M.ROOT-SERVERS.NET. 604794 IN A 202.12.27.33M.ROOT-SERVERS.NET. 604791 IN AAAA 2001:dc3::35

[root@elrond ~]# 37

dig opus.cabrillo.edu (start with root "." servers)

We don't get an answer but we do get referred to a long list of root name servers we can ask.

Pick one at random to continue

IP addresses for these servers

CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd opus.cabrillo.edu @J.ROOT-SERVERS.NET.;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53616;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 7, ADDITIONAL: 8

;; AUTHORITY SECTION:edu. 172800 IN NS E.GTLD-SERVERS.NET.edu. 172800 IN NS F.GTLD-SERVERS.NET.edu. 172800 IN NS G.GTLD-SERVERS.NET.edu. 172800 IN NS L.GTLD-SERVERS.NET.edu. 172800 IN NS A.GTLD-SERVERS.NET.edu. 172800 IN NS C.GTLD-SERVERS.NET.edu. 172800 IN NS D.GTLD-SERVERS.NET.

;; ADDITIONAL SECTION:A.GTLD-SERVERS.NET. 172800 IN A 192.5.6.30A.GTLD-SERVERS.NET. 172800 IN AAAA 2001:503:a83e::2:30C.GTLD-SERVERS.NET. 172800 IN A 192.26.92.30D.GTLD-SERVERS.NET. 172800 IN A 192.31.80.30E.GTLD-SERVERS.NET. 172800 IN A 192.12.94.30F.GTLD-SERVERS.NET. 172800 IN A 192.35.51.30G.GTLD-SERVERS.NET. 172800 IN A 192.42.93.30L.GTLD-SERVERS.NET. 172800 IN A 192.41.162.30

[root@elrond ~]#

38

dig opus.cabrillo.edu (edu. servers)

Still no answer but we get referred to a list of generic top level domain name servers for the edu domain

Pick one at random to continue

IP addresses for the edu domain nameservers

CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd opus.cabrillo.edu @F.GTLD-SERVERS.NET.;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17333;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 3

;; AUTHORITY SECTION:cabrillo.edu. 172800 IN NS buttercup.cabrillo.edu.cabrillo.edu. 172800 IN NS ns1.csu.net.cabrillo.edu. 172800 IN NS ns2.csu.net.

;; ADDITIONAL SECTION:buttercup.cabrillo.edu. 172800 IN A 207.62.187.54ns1.csu.net. 172800 IN A 130.150.102.100ns2.csu.net. 172800 IN A 130.150.102.20

[root@elrond ~]#

39

dig opus.cabrillo.edu (cabrillo.edu. servers)

Still no answer but we get referred to a list of cabrillo name servers for the cabrillo.edu domain

Pick one at random to continueIP addresses for the Cabrillo name servers

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd opus.cabrillo.edu @ns1.csu.net.;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6591;; flags: qr aa ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3

;; ANSWER SECTION:opus.cabrillo.edu. 300 IN A 207.62.186.9

;; AUTHORITY SECTION:cabrillo.edu. 300 IN NS ns1.csu.net.cabrillo.edu. 300 IN NS ns2.csu.net.cabrillo.edu. 300 IN NS buttercup.cabrillo.edu.

;; ADDITIONAL SECTION:ns1.csu.net. 15219 IN A 130.150.102.100ns2.csu.net. 15324 IN A 130.150.102.20buttercup.cabrillo.edu. 300 IN A 207.62.187.54

[root@elrond ~]#

CIS 192 - Lesson 9

40

dig opus.cabrillo.edu (resolved)

Hooray! It worked …. we got an answer!

hostcommand

41

[root@elrond named]# host www.google.comwww.google.com is an alias for www.l.google.com.www.l.google.com has address 74.125.127.99www.l.google.com has address 74.125.127.103www.l.google.com has address 74.125.127.104www.l.google.com has address 74.125.127.147

[root@elrond named]# host 74.125.127.9999.127.125.74.in-addr.arpa domain name pointer pz-in-f99.google.com.[root@elrond named]#

CIS 192 - Lesson 9

42

host command

Forward lookup

Reverse lookup

Note the structure of the IP address "hostname" (reverse order with top of tree on the right and leaves to the left)

forwardlookupzone

database43

CIS 192 - Lesson 9

44

Zone file

[root@elrond ~]# cat /var/named/db.rivendell $TTL 604800; Rivendell Zone Definition;;Rivendell. IN SOA elrond.rivendell. root.rivendell. ( 2009040304 ; serial number 60 ; refresh rate in seconds 15 ; retry in seconds 1209600 ; expire in seconds 300) ; minimum in seconds;;;;Name Server RecordsRivendell. IN NS elrond.rivendell.;;Address Recordslocalhost IN A 127.0.0.1legolas IN A 192.168.2.105elrond IN A 192.168.2.107galadriel IN A 192.168.2.108william IN A 192.168.2.114;;CNAME records[root@elrond ~]#

TTL = Time to live. How long a DNS record from this zone should be cached.

The longer the TTL value the faster domain resolution time periods will be.

Examples:

$TTL 86400$TTL 1440m$TTL 24h$TTL 1d

CIS 192 - Lesson 9

45

Primary domain name

Zone file


CIS 192 - Lesson 9

46

Class of the zone

IN = Internet

Zone file


CIS 192 - Lesson 9

47

Record type

SOA = Start of Authority

Zone file


Zone file


CIS 192 - Lesson 9

48

The primary DNS server for this zone

CIS 192 - Lesson 9

49

The email address of the person/authority in charge. Note the "@" is replaced by a "."

Zone file


Zone file


CIS 192 - Lesson 9

50

Serial number, typically YYYYMMDDNN.

Must be updated to a larger number whenever zone file is updated or the changes will be ignored by BIND

CIS 192 - Lesson 9

51

Refresh rate

How often the secondary server should poll the primary to refresh it data

It is set to only 60 seconds for Lab 7 so we can see zone transfers happen quickly.

Zone file


CIS 192 - Lesson 9

52

Retry

A value typically an hour or less that the secondary server should repeat an update request if the primary failed to respond.

Zone file


Zone file


CIS 192 - Lesson 9

53

Expire

In the case where the secondary server can no longer reach the primary, this is the amount of time the zone information can be used.

secondarys servers will stop responding to requests for this zone once the data has expired.

A successful refresh (a zone update) will reset the timers and the cycle will begin again.

Zone file


CIS 192 - Lesson 9

54

Minimum

How long a non-authoritative server should cache an entry in case of failed lookups

Zone file


CIS 192 - Lesson 9

55

NS (Name Server) records indicate the authoritative name servers for this zone.

Public domains are required to have at least two name servers.

Private domains may have just one.

Zone file


CIS 192 - Lesson 9

56

Each A records matches a hostname with an IPv4 address.

reverselookupzone

datbase57

Zone file

[root@elrond named]# cat db.2.168.192 $TTL 86400;192.168.2.* Reverse Zone Definition;2.168.192.in-addr.arpa. IN SOA elrond.rivendell. root.rivendell. ( 2009040311 ; Serial 60 ; Refresh 15 ; Retry 3600000 ; Expire 86400 ) ; Minimum;;Name Server Records;2.168.192.in-addr.arpa. IN NS elrond.rivendell.;;Address Records105 IN PTR legolas.rivendell.107 IN PTR elrond.rivendell.108 IN PTR galadriel.rivendell.114 IN PTR william.rivendell.[root@elrond named]#

CIS 192 - Lesson 9

58

Note the use of PTR records to match the final portion of the IP address to a host name

named.conf

59

60

[root@elrond named]# cat /etc/named.confoptions { directory "/var/named"; /* * If there is a firewall between you and nameservers you want * to talk to, you might need to uncomment the query-source * directive below. Previous versions of BIND always asked * questions using port 53, but BIND 8.1 uses an unprivileged * port by default. */ // query-source address * port 53;};

//// a caching only nameserver config//controls { inet 127.0.0.1 allow { localhost; } keys { rndckey; };};

zone "." IN { type hint; file "named.ca";};

CIS 192 - Lesson 9

This is where the zone database files reside

The hints are really the IP addresses of all the top level root name servers

61

zone "localhost" IN { type master; file "localhost.zone"; allow-update { none; };};

zone "0.0.127.in-addr.arpa" IN { type master; file "named.local"; allow-update { none; };};

zone "rivendell" IN { type master; file "db.rivendell"; allow-update { none; };};

zone "2.168.192.in-addr.arpa" IN { type master; file "db.2.168.192"; allow-update { none; };};

// A key file needs to be referenced for use by rndc.include "/etc/rndc.key"; [root@elrond named]#

CIS 192 - Lesson 9

In Lab 7 you will setup forward and reverse zones for the Rivendell domain

zone transfer

62

CIS 192 - Lesson 9

63

Zone transfer

The secondary server does this to obtain the zone databases from the primary server

CIS 192 - Lesson 9

64

A successful zone transfer

/var/log/messages:Apr 6 07:30:59 legolas named[16429]: zone rivendell/IN: Transfer started.Apr 6 07:30:59 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: connected using 192.168.2.105#46736Apr 6 07:30:59 legolas named[16429]: zone rivendell/IN: transferred serial 2009040309Apr 6 07:30:59 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: end of transfer

Request from secondary

Response from primary

zone records

DNSTroubleshooting

65

CIS 192 - Lesson 9

66

Lab 7 Troubleshooting

Problem: primary to secondary transfer failing

From /var/log/messages:Apr 6 06:39:33 legolas named[16429]: zone rivendell/IN: Transfer started.Apr 6 06:39:33 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: connected using 192.168.2.105#54165Apr 6 06:39:33 legolas named[16429]: dumping primary file: tmp-UjD7J9kLlr: open: permission deniedApr 6 06:39:33 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: failed while receiving responses: permission deniedApr 6 06:39:33 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: end of transfer

Solution:Enable named to create new files on secondary:1.Run lokkit on secondary and change SELinux setting from Enforcing to Permissive2.Use chmod 770 /var/named on secondary

CIS 192 - Lesson 9

67



From /var/log/messages:Apr 6 07:01:15 legolas named[16429]: zone rivendell/IN: refresh: retry limit for master 192.168.2.107#53 exceeded (source 0.0.0.0#0)Apr 6 07:01:15 legolas named[16429]: zone rivendell/IN: Transfer started.Apr 6 07:01:15 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: failed to connect: host unreachableApr 6 07:01:15 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: end of transfer

Solution:Firewall on master is blocking connection by secondary for transfer1.Run lokkit on primary and disable firewall or2.Open port UDP port 53 on primary

CIS 192 - Lesson 9

68

Zone transfer failing when blocked by firewall on primary

Lab 7

69

CIS 192 - Lesson 9

70

Lab 7

http://simms-teach.com/docs/cis192/cis192lab07.pdf

http://simms-teach.com/docs/cis192/cis192lab07.pdf

Wrap

71

CIS 192 - Lesson 9

New commands, daemons:named DNS daemonhost For testing DNSdig DNS informationnslookup Being phased outrndc reload Reload DNS configuration files

Configuration files/etc/named.conf/var/named/*/etc/resolv.conf/etc/nsswitch.conf/etc/hosts

72

Assignment: Check Calendar Page http://simms-teach.com/cis192calendar.php

Quiz questions for next class:

•What two packages must be installed to setup a name server with caching?

•What is the purpose of a PTR record?

•How does the serial number effect zone transfers?


Next Class (after Spring Break)

73

http://simms-teach.com/cis192calendar.php

74

Backup

75

Station IP Static 1

Instructor 172.30.1.100 172.30.1.125

Station-01 172.30.1.101 172.30.1.126

Station-02 172.30.1.102 172.30.1.127

Station-03 172.30.1.103 172.30.1.128

Station-04 172.30.1.104 172.30.1.129

Station-05 172.30.1.105 172.30.1.130

Station-06 172.30.1.106 172.30.1.131

Station-07 172.30.1.107 172.30.1.132

Station-08 172.30.1.108 172.30.1.133

Station-09 172.30.1.109 172.30.1.134

Station-10 172.30.1.110 172.30.1.135

Station-11 172.30.1.111 172.30.1.136

Station-12 172.30.1.112 172.30.1.137

Station IP Static 1

Station-13 172.30.1.113 172.30.1.138

Station-14 172.30.1.114 172.30.1.139

Station-15 172.30.1.115 172.30.1.140

Station-16 172.30.1.116 172.30.1.141

Station-17 172.30.1.117 172.30.1.142

Station-18 172.30.1.118 172.30.1.143

Station-19 172.30.1.119 172.30.1.144

Station-20 172.30.1.120 172.30.1.145

Station-21 172.30.1.121 172.30.1.146

Station-22 172.30.1.122 172.30.1.147

Station-23 172.30.1.123 172.30.1.148

Station-24 172.30.1.124 172.30.1.149

CIS 192 - Lesson 9

Classroom Static IP addresses for VM's

Note the static IP address for your station to use in the next class exercise

CIS 192 - Lesson 9

Classroom DHCP IP allocation pools table by station number

Station IP Start End

01 172.30.1.101 172.30.1.50 172.30.1.54

02 172.30.1.102 172.30.1.55 172.30.1.59

03 172.30.1.103 172.30.1.60 172.30.1.64

04 172.30.1.104 172.30.1.65 172.30.1.69

05 172.30.1.105 172.30.1.70 172.30.1.74

06 172.30.1.106 172.30.1.75 172.30.1.79

07 172.30.1.107 172.30.1.80 172.30.1.84

08 172.30.1.108 172.30.1.85 172.30.1.89

09 172.30.1.109 172.30.1.90 172.30.1.94

10 172.30.1.110 172.30.1.95 172.30.1.99

11 172.30.1.111 172.30.1.200 172.30.1.204

12 172.30.1.112 172.30.1.205 172.30.1.209

Station IP Start End

13 172.30.1.101 172.30.1.210 172.30.1.214

14 172.30.1.102 172.30.1.215 172.30.1.219

15 172.30.1.103 172.30.1.220 172.30.1.224

16 172.30.1.104 172.30.1.225 172.30.1.229

17 172.30.1.105 172.30.1.230 172.30.1.234

18 172.30.1.106 172.30.1.235 172.30.1.239

19 172.30.1.107 172.30.1.240 172.30.1.244

20 172.30.1.108 172.30.1.245 172.30.1.249

21 172.30.1.109 172.30.1.250 172.30.1.254

22 172.30.1.110 172.30.1.30 172.30.1.34

23 172.30.1.111 172.30.1.35 172.30.1.39

24 172.30.1.112 172.30.1.20 172.30.1.44

Instruct 172.30.1.100 172.30.1.45 172.30.1.49

Use these pools of addresses based on your station number to avoid conflicts on the classroom network

78

Elrond

eth1

.10

192.168.2.8/30172.30.4.0/24

eth2.1xx.1xy

Arwen

eth0

.9

ServerClient Gateway

eth0

dhcp

Frodo

Shire(Outside)

Rivendell(Inside)

Jin

eth1

.10

192.168.2.8/30172.30.4.0/24

eth2.108

Sun

eth0

.9

ClientGateway

(Outside) (Inside)Internet

CIS 192 - Lesson 9

79

1234567891011121314

Client Server

IP: IP:

Port: Port:

80

nosmo

207.62.187.54Internet

.1

DNS

.10

snickers

DHCP

buttercup

eth0

.1XX

eth1

.1XX

eth0 dhcp

eth0

.150

eth1

.150

elrond

frodo

legolas

sauronwilliam

eth0 dhcp eth0 dhcp

DHCP

DHCPServer

DHCPRelay Agent

172.30.N.0 /24

Shire

192.168.2.0 /24

Rivendell

192.168.3.0 /24

Mordor

DHCP

DHCP Reservation

client client client

CIS 192 - Lesson 9

[root@elrond ~]# dig +norec +noques +nostats +nocmd simms-teach.com;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16548;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0

;; AUTHORITY SECTION:com. 172798 IN NS G.GTLD-SERVERS.NET.com. 172798 IN NS M.GTLD-SERVERS.NET.com. 172798 IN NS K.GTLD-SERVERS.NET.com. 172798 IN NS A.GTLD-SERVERS.NET.com. 172798 IN NS C.GTLD-SERVERS.NET.com. 172798 IN NS L.GTLD-SERVERS.NET.com. 172798 IN NS J.GTLD-SERVERS.NET.com. 172798 IN NS H.GTLD-SERVERS.NET.com. 172798 IN NS B.GTLD-SERVERS.NET.com. 172798 IN NS I.GTLD-SERVERS.NET.com. 172798 IN NS E.GTLD-SERVERS.NET.com. 172798 IN NS F.GTLD-SERVERS.NET.com. 172798 IN NS D.GTLD-SERVERS.NET.

81

dig simms-teach.com (com. servers)

NS = Authoritative Name Server record

IN = Internet Domain Names

CIS 192 - Lesson 9

[root@elrond ~]# dig +norec +noques +nostats +nocmd simms-teach.com @A.GTLD-SERVERS.NET.;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40276;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 3

;; AUTHORITY SECTION:simms-teach.com. 172800 IN NS ns1.dreamhost.com.simms-teach.com. 172800 IN NS ns2.dreamhost.com.simms-teach.com. 172800 IN NS ns3.dreamhost.com.

;; ADDITIONAL SECTION:ns1.dreamhost.com. 172800 IN A 66.33.206.206ns2.dreamhost.com. 172800 IN A 208.96.10.221ns3.dreamhost.com. 172800 IN A 66.33.216.216

[root@elrond ~]#

82

dig simms-teach.com (simms-teach.com. servers)

CIS 192 - Lesson 9

[root@elrond ~]# dig +norec +noques +nostats +nocmd simms-teach.com @ns1.dreamhost.com;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60986;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; ANSWER SECTION:simms-teach.com. 14400 IN A 208.113.161.13

[root@elrond ~]#

[root@elrond ~]# ping -c2 simms-teach.comPING simms-teach.com (208.113.161.13) 56(84) bytes of data.64 bytes from apache2-zoo.nehi.dreamhost.com (208.113.161.13): icmp_seq=1 ttl=56 time=26.1 ms64 bytes from apache2-zoo.nehi.dreamhost.com (208.113.161.13): icmp_seq=2 ttl=56 time=25.9 ms

--- simms-teach.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 1000msrtt min/avg/max/mdev = 25.973/26.078/26.184/0.192 ms[root@elrond ~]#

83

dig simms-teach.com (ANSWER section received)

CIS 192 - Lesson 9

84

An example of what it is like to be a resolver doing a reverse lookup using the dig command

CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd 9.186.62.207.in-addr.arpa;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26350;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 5

;; AUTHORITY SECTION:. 518387 IN NS I.ROOT-SERVERS.NET.. 518387 IN NS C.ROOT-SERVERS.NET.. 518387 IN NS E.ROOT-SERVERS.NET.. 518387 IN NS F.ROOT-SERVERS.NET.. 518387 IN NS K.ROOT-SERVERS.NET.. 518387 IN NS A.ROOT-SERVERS.NET.. 518387 IN NS L.ROOT-SERVERS.NET.. 518387 IN NS H.ROOT-SERVERS.NET.. 518387 IN NS M.ROOT-SERVERS.NET.. 518387 IN NS B.ROOT-SERVERS.NET.. 518387 IN NS G.ROOT-SERVERS.NET.. 518387 IN NS D.ROOT-SERVERS.NET.. 518387 IN NS J.ROOT-SERVERS.NET.

;; ADDITIONAL SECTION:A.ROOT-SERVERS.NET. 604782 IN A 198.41.0.4A.ROOT-SERVERS.NET. 604787 IN AAAA 2001:503:ba3e::2:30E.ROOT-SERVERS.NET. 604787 IN A 192.203.230.10M.ROOT-SERVERS.NET. 604787 IN A 202.12.27.33M.ROOT-SERVERS.NET. 604782 IN AAAA 2001:dc3::35

[root@elrond ~]#

85

dig 9.186.62.207.in-addr.arpa

CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd 9.186.62.207.in-addr.arpa @A.ROOT-SERVERS.NET.

;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12044;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 0

;; AUTHORITY SECTION:207.in-addr.arpa. 86400 IN NS X.ARIN.NET.207.in-addr.arpa. 86400 IN NS BASIL.ARIN.NET.207.in-addr.arpa. 86400 IN NS HENNA.ARIN.NET.207.in-addr.arpa. 86400 IN NS Y.ARIN.NET.207.in-addr.arpa. 86400 IN NS CHIA.ARIN.NET.207.in-addr.arpa. 86400 IN NS DILL.ARIN.NET.207.in-addr.arpa. 86400 IN NS Z.ARIN.NET.207.in-addr.arpa. 86400 IN NS INDIGO.ARIN.NET.

[root@elrond ~]#

86


CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd 9.186.62.207.in-addr.arpa @BASIL.ARIN.NET.

;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56550;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0

;; AUTHORITY SECTION:62.207.in-addr.arpa. 86400 IN NS ns2.csu.net.62.207.in-addr.arpa. 86400 IN NS ns1.csu.net.

[root@elrond ~]#

87


CIS 192 - Lesson 9

[root@elrond ~]# dig +norecurse +noques +nostats +nocmd 9.186.62.207.in-addr.arpa @ns1.csu.net;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58855;; flags: qr aa ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; AUTHORITY SECTION:186.62.207.in-addr.arpa. 28800 IN SOA buttercup.cabrillo.edu.

hostmaster.cabrillo.edu. 2004062137 3600 1800 604800 28800

[root@elrond ~]#

88


Firewall and DNS port

89

CIS 192 - Lesson 9

90

Default firewall on CentOS (Red Hat) does not allow DNS requests

[root@elrond ~]# iptables -LChain INPUT (policy ACCEPT)target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp any ACCEPT esp -- anywhere anywhere ACCEPT ah -- anywhere anywhere ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere anywhere udp dpt:ipp ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited [root@elrond ~]#

UDP port 53 is not open

CIS 192 - Lesson 9

91

Default firewall on CentOS (Red Hat) does not allow DNS requests

[root@elrond ~]# cat /etc/sysconfig/iptables# Firewall configuration written by system-config-securitylevel# Manual customization of this file is not recommended.*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]:RH-Firewall-1-INPUT - [0:0]-A INPUT -j RH-Firewall-1-INPUT-A FORWARD -j RH-Firewall-1-INPUT-A RH-Firewall-1-INPUT -i lo -j ACCEPT-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT-A RH-Firewall-1-INPUT -p 50 -j ACCEPT-A RH-Firewall-1-INPUT -p 51 -j ACCEPT-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibitedCOMMIT[root@elrond ~]#

UDP port 53 is not open

CIS 192 - Lesson 9

92

[root@elrond ~]# iptables -I RH-Firewall-1-INPUT 9 -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT

This command inserts a new rule on the custom firewall chain on the primary to allow new UDP port 53 requests

line number to insert before

-m specifies match modules to use-p specified protocol to match-I to insert a new rule--state NEW for new (not yet established) connections--dport for the destination port

Name of chain

CIS 192 - Lesson 9

93

Modified firewall on CentOS (Red Hat) now allows DNS requests

[root@elrond ~]# iptables -LChain INPUT (policy ACCEPT)target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp any ACCEPT esp -- anywhere anywhere ACCEPT ah -- anywhere anywhere ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere anywhere udp dpt:ipp ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT udp -- anywhere anywhere state NEW udp dpt:domain ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited [root@elrond ~]#

UDP port 53 is open

CIS 192 - Lesson 9

94

Modified firewall on CentOS (Red Hat) primary now allows DNS requests

UDP port 53 is open

DNSTrobleshooting

95

CIS 192 - Lesson 9

96



From /var/log/messages:Apr 6 06:39:33 legolas named[16429]: zone rivendell/IN: Transfer started.Apr 6 06:39:33 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: connected using 192.168.2.105#54165Apr 6 06:39:33 legolas named[16429]: dumping primary file: tmp-UjD7J9kLlr: open: permission deniedApr 6 06:39:33 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: failed while receiving responses: permission deniedApr 6 06:39:33 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: end of transfer

Solution:Enable named to create new files on secondary:1.Run lokkit on secondary and change SELinux setting from Enforcing to Permissive2.Use chmod 770 /var/named on secondary

CIS 192 - Lesson 9

97



From /var/log/messages:Apr 6 07:01:15 legolas named[16429]: zone rivendell/IN: refresh: retry limit for primary 192.168.2.107#53 exceeded (source 0.0.0.0#0)Apr 6 07:01:15 legolas named[16429]: zone rivendell/IN: Transfer started.Apr 6 07:01:15 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: failed to connect: host unreachableApr 6 07:01:15 legolas named[16429]: transfer of 'rivendell/IN' from 192.168.2.107#53: end of transfer

Solution:Firewall on primary is blocking connection by secondary for transfer1.Run lokkit on primary and disable firewall or2.Open port UDP port 53 on primary

CIS 192 - Lesson 9

98

Zone transfer failing when blocked by firewall on primary

Documents

CIS 192 – Lesson 9 Lesson Module Status Slides – draft Properties - done Flashcards - 1 st minute quiz – done Web Calendar summary – Web book pages – Commands